Splunk Search

Compute time offset of each event compared to the transaction start

esflavio
New Member

In my situation I have "Web Requests" events, which I group in transactions with the following search:

sourcetype="WEB Request" 
| eval request_date=_time
| transaction user maxpause=10m startswith="logged in" mvlist="request_date"

I now have every request's absolute date, in order. And I would like to compute a multi valued field that would represent the offset of each request date compared to the session date.

Basically, if the field was not multivalued, I could complete the search with something like:

| eval request_time_offset=request_date - _time

But the field is multivalued, and I am not sure how to proceed.

0 Karma

wpreston
Motivator

I'm not quite sure how to make it a multivalued field on the transaction, but here's one way you can calculate the time offset for each part of your transaction. You'll need another field that differentiates each part of the transaction, like a user's action or request. For purposes of this example, I'll call that field "Request":

sourcetype="WEB Request"  
| eval request_date=_time 
| transaction user maxpause=10m startswith="logged in" mvlist="request_date,Request"
| eval SplitField=mvzip(request_date,Request)
| mvexpand SplitField
| rex field=SplitField "(?<Request>[^,]+),(?<Request>.*)"
| eval ElapsedTime=request_date-_time
| table user Request request_date _time ElapsedTime
0 Karma

esflavio
New Member

@martin_mueller: I want to compute statistics on, for example, how late in a session a given page is accessed, to better model the users' behavior.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What are you ultimately trying to achieve?

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...